CVE-2018-7642: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The swapstdrelocin function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows attackers to cause a denial of service (aout32swapstdrelocout NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.
Upstream issue:
https://sourceware.org/bugzilla/showbug.cgi?id=22887
Upstream patches:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=116acb2c268c89c89186673a7c92620d21825b25
— Red Hat
The swapstdrelocin function in aoutx.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (aout32swapstdrelocout NULL pointer dereference and application crash) via a crafted ELF file, as demonstrated by objcopy.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/binutilsto a version that resolves this vulnerability.Fixed in 2.35.2-2Fixed in 2.40-2Fixed in 2.44-3
Event History
Frequently Asked Questions
What is CVE-2018-7642?
CVE-2018-7642 is a vulnerability in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.30.
How severe is CVE-2018-7642?
CVE-2018-7642 is classified as a low severity vulnerability.
Which software is affected by CVE-2018-7642?
The affected software is binutils version 2.30-6 on Ubuntu, binutils version 2.26.1-1ubuntu1~16.04.8+ on Ubuntu (xenial), and binutils versions 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5 on Debian.
How can I fix CVE-2018-7642?
To fix CVE-2018-7642, update to binutils version 2.30-6 on Ubuntu, binutils version 2.26.1-1ubuntu1~16.04.8+ on Ubuntu (xenial), or binutils versions 2.31.1-16, 2.35.2-2, 2.40-2, or 2.41-5 on Debian, depending on the affected software.
Where can I find more information about CVE-2018-7642?
You can find more information about CVE-2018-7642 at the following references: https://sourceware.org/bugzilla/show_bug.cgi?id=22887, https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=116acb2c268c89c89186673a7c92620d21825b25, and https://access.redhat.com/errata/RHSA-2018:3032.